add trusted_downstream to HTTPServer

config.py

@@ -2,6 +2,7 @@ DEBUG = True
 DEFAULT_DATA_DIR = '/tmp'
 DEFAULT_PORT = 8888
 XHEADERS = True # you may set this to false if not behind another server
+TRUSTED_DOWNSTREAM = ['127.0.0.1']
 DB = 'elimage.db'
 
 PREFIX = r'/elimage' # For WSGI. this is a regex

main.py

@@ -211,8 +211,11 @@ def main():
     debug=DEBUG,
     template_path=os.path.join(os.path.dirname(__file__), "templates"),
   )
-  http_server = tornado.httpserver.HTTPServer(application,
-                                              xheaders=XHEADERS)
+  http_server = tornado.httpserver.HTTPServer(
+    application,
+    xheaders=XHEADERS,
+    trusted_downstream=TRUSTED_DOWNSTREAM,
+  )
   http_server.listen(options.port)
   tornado.ioloop.IOLoop.instance().start()